CVE-2002-1025: Undefined Security Weakness

JRun 3.0 through 4.0 allows remote attackers to read JSP source code via an encoded null byte in an HTTP GET request, which causes the server to send the .JSP file unparsed...

CVE-2002-1533

Cross-site scripting XSS vulnerability in Jetty JSP servlet engine allows remote attackers to insert arbitrary HTML or script via an HTTP request to a .jsp file whose name contains the malicious script and some encoded linefeed characters %0a...

Apache Tomcat Directory Listing and File Disclosure

Apache Tomcat prior to 3.3.1a is affected by a directory listing and file disclosure vulnerability. By requesting URLs containing a null character, remote attackers can list directories even when an index.html or other file is present or obtain unprocessed source code for a JSP file. Also note...

CVE-2002-1533

The CVE-2002-1533 entry describes a cross-site scripting (XSS) vulnerability in the Jetty JSP servlet engine. An attacker can inject arbitrary HTML or script by constructing an HTTP request to a .jsp file whose name contains the malicious script and encoded linefeed characters (%0a). Affected sof...

CVE-2002-1533

Cross-site scripting XSS vulnerability in Jetty JSP servlet engine allows remote attackers to insert arbitrary HTML or script via an HTTP request to a .jsp file whose name contains the malicious script and some encoded linefeed characters %0a...

CVE-2002-1533: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Jetty JSP servlet engine allows remote attackers to insert arbitrary HTML or script via an HTTP request to a .jsp file whose name contains the malicious script and some encoded linefeed characters %0a...

Apache Jakarta Tomcat 3 URL parsing vulnerability

OVERVIEW ======== Tomcat is a JSP/Servlet implementation developed at the Apache Software Foundation. Tomcat versions 3.3.1 and earlier contain some security vulnerabilities which allow a remote user to retrieve listings of directories despite index.html or index.jsp files. It is also possible to...

CVE-2003-0042

CVE-2003-0042 affects Apache Jakarta Tomcat up to version 3.3.1a when used with JDK 1.3.1 or earlier. The vulnerability lets remote attackers cause directory listings and disclose JSP/source via a URL containing a null character, bypassing index.html or other welcome-file safeguards. Root cause i...

DSA-225 tomcat4 - source disclosure

Bulletin has no description...

CVE-2002-2009

Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by 1 +/, 2 /, 3 /, and 4 %20/, which leaks the pathname in an error message...

CVE-2002-1310: Undefined Security Weakness

Heap-based buffer overflow in the error-handling mechanism for the IIS ISAPI handler in Macromedia JRun 4.0 and earlier allows remote attackers to execute arbitrary via an HTTP GET request with a long .jsp file name...

Important: Red Hat Security Advisory: tomcat security update for Stronghold

Updated tomcat packages are now available for Stronghold Cross Platform to close a JSP source code exposure vulnerability. Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. A source code exposure...

Important: Red Hat Security Advisory: tomcat security update for Stronghold

Updated tomcat packages are now available for Stronghold on Red Hat Linux Advanced Server to close a JSP source code exposure vulnerability. Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. A source code...

JSP source code exposure in Tomcat 4.x

Tomcat 4.x JSP source exposure security advisory 1. Summary Tomcat 4.0.4 and 4.1.10 probably all other earlier versions also are vulnerable to source code exposure by using the default servlet org.apache.catalina.servlets.DefaultServlet. 2. Details: Let say you have valid URL like...

Unauthorizaed Apache Tomcat JSP source code disclosure

org.apache.catalina.servlets.DefaultServ let allows to access any JSP code...

Apache Tomcat 34 - DefaultServlet File Disclosure

Apache Tomcat 34 - DefaultServlet File Disclosure source: https://www.securityfocus.com/bid/5786/info The servlet 'org.apache.catalina.servlets.DefaultServlet' is included with Apache Tomcat by default. It is possible to use this servlet to view contents of files within the webroot. This includes...

Fixed in Apache Tomcat 4.1.12, 4.0.5

Important: Information disclosure CVE-2002-1148 A specially crafted URL using the default servlet can enable an attacker to obtain the source of JSP pages. Affects: 4.0.0-4.0.4, 4.1.0-4.1.11...

Apache Tomcat 3/4 - 'DefaultServlet' File Disclosure

source: https://www.securityfocus.com/bid/5786/info The servlet 'org.apache.catalina.servlets.DefaultServlet' is included with Apache Tomcat by default. It is possible to use this servlet to view contents of files within the webroot. This includes JSP source code, which may contain sensitive data...

Jakarta Tomcat serves JSP source code when supplied malformed HTTP request

Overview Tomcat does not adequately validate HTTP requests and may reveal JSP source code if supplied a malformed HTTP request. Description JavaServer Pages JSP is a technology that allows for the creation of dynamic web content. The Apache Jakarta Project implementation of JSP is known as Tomcat...

CVE-2002-0936

CVE-2002-0936 affects the Java Server Pages (JSP) engine in Apache Tomcat. A JSP page that calls WPrinterJob().pageSetup(null,null) can cause a denial of service by crashing the web server. The published materials describe the vulnerability and impact but do not provide a listed fix or patch with...